Perform range checking on app supplied texture base level

It is possible for applications to specify any texture base level,
including trivially invalid values (i.e., 47000000).  When an app
specifies an invalide base level, we should gracefully disable the
texture instead of accessing memory outside the gl_texture_object.

This fixes an occasional segfault in one of our conformance tests.

diff --git a/src/mesa/main/texobj.c b/src/mesa/main/texobj.c
index 2a54ff7ff9078d8fbb7b87347fad1d3ce7111067..d8e8b559f53a604328898183fb1013d270186358 100644 (file)
--- a/src/mesa/main/texobj.c
+++ b/src/mesa/main/texobj.c
@@ -383,6 +383,18 @@ _mesa_test_texobj_completeness( const GLcontext *ctx,
 
    t->_Complete = GL_TRUE;  /* be optimistic */
 
+   /* Detect cases where the application set the base level to an invalid
+    * value.
+    */
+   if ((baseLevel < 0) || (baseLevel > MAX_TEXTURE_LEVELS)) {
+      char s[100];
+      _mesa_sprintf(s, "obj %p (%d) base level = %d is invalid",
+              (void *) t, t->Name, baseLevel);
+      incomplete(t, s);
+      t->_Complete = GL_FALSE;
+      return;
+   }
+
    /* Always need the base level image */
    if (!t->Image[0][baseLevel]) {
       char s[100];